EC-COUNCIL 312-50 Online Practice Questions and Exam Preparation

EC-COUNCIL 312-50 Online Questions & Answers

• Question 111:

  Lauren is performing a network audit for her entire company. The entire network is comprised of around 500 computers. Lauren starts an ICMP ping sweep by sending one IP packet to the broadcast address of the network, but only receives responses from around five hosts. Why did this ping sweep only produce a few responses?

  A. Only Windows systems will reply to this scan.
  B. A switched network will not respond to packets sent to the broadcast address.
  C. Only Linux and Unix-like (Non-Windows) systems will reply to this scan.
  D. Only servers will reply to this scan.
  C. Only Linux and Unix-like (Non-Windows) systems will reply to this scan.

• Question 112:

  A digital signature is simply a message that is encrypted with the public key instead of the private key.

  A. True
  B. False
  B. False

  ---

  Digital signatures enable the recipient of information to verify the authenticity of the information's origin, and also verify that the information is intact. Thus, public key digital signatures provide authentication and data integrity. A digital signature also provides non-repudiation, which means that it prevents the sender from claiming that he or she did not actually send the information. Instead of encrypting information using someone else's public key, you encrypt it with your private key. If the information can be decrypted with your public key, then it must have originated with you.

• Question 113:

  Drag the term to match with it's description.

  Select and Place:

  

  

• Question 114:

  When a malicious hacker identifies a target and wants to eventually compromise this target, what would be the first step the attacker would perform?

  A. Cover his tracks by eradicating the log files
  B. Gain access to the remote computer for identification of venue of attacks
  C. Perform a reconnaissance of the remote target for identification of venue of attacks
  D. Always starts with a scan in order to quickly identify venue of attacks
  C. Perform a reconnaissance of the remote target for identification of venue of attacks

• Question 115:

  What is a NULL scan?

  A. A scan in which all flags are turned off
  B. A scan in which certain flags are off
  C. A scan in which all flags are on
  D. A scan in which the packet size is set to zero
  E. A scan with a illegal packet size
  A. A scan in which all flags are turned off

  ---

  A null scan has all flags turned off.

• Question 116:

  Darren is the network administrator for Greyson and Associates, a large law firm in Houston. Darren is responsible for all network functions as well as any digital forensics work that is needed. Darren is examining the firewall logs one morning and notices some unusual activity. He traces the activity target to one of the firm's internal file servers and finds that many documents on that server were destroyed. After performing some calculations, Darren finds the damage to be around $75,000 worth of lost data. Darren decides that this incident should be handled and resolved within the same day of its discovery.

  What incident level would this situation be classified as?

  A. This situation would be classified as a mid-level incident
  B. Since there was over $50,000 worth of loss, this would be considered a high-level incident
  C. Because Darren has determined that this issue needs to be addressed in the same day it was discovered, this would be considered a low-level incident
  D. This specific incident would be labeled as an immediate-level incident
  D. This specific incident would be labeled as an immediate-level incident

• Question 117:

  Travis works primarily from home as a medical transcriptions.

  He just bought a brand new Dual Core Pentium Computer with over 3 GB of RAM. He uses voice recognition software is processor intensive, which is why he bought the new computer. Travis frequently has to get on the Internet to do research on what he is working on. After about two months of working on his new computer, he notices that it is not running nearly as fast as it used to.

  Travis uses antivirus software, anti-spyware software and always keeps the computer up-to-date with Microsoft patches.

  After another month of working on the computer, Travis computer is even more noticeable slow. Every once in awhile, Travis also notices a window or two pop-up on his screen, but they quickly disappear. He has seen these windows show up, even when he has not been on the Internet. Travis is really worried about his computer because he spent a lot of money on it and he depends on it to work. Travis scans his through Windows Explorer and check out the file system, folder by folder to see if there is anything he can find. He spends over four hours pouring over the files and folders and can't find anything but before he gives up, he notices that his computer only has about 10 GB of free space available. Since has drive is a 200 GB hard drive, Travis thinks this is very odd.

  Travis downloads Space Monger and adds up the sizes for all the folders and files on his computer. According to his calculations, he should have around 150 GB of free space. What is mostly likely the cause of Travi's problems?

  A. Travis's Computer is infected with stealth kernel level rootkit
  B. Travi's Computer is infected with Stealth Torjan Virus
  C. Travis's Computer is infected with Self-Replication Worm that fills the hard disk space
  D. Logic Bomb's triggered at random times creating hidden data consuming junk files
  A. Travis's Computer is infected with stealth kernel level rootkit

  ---

  A rootkit can take full control of a system. A rootkit's only purpose is to hide files, network connections, memory addresses, or registry entries from other programs used by system administrators to detect intended or unintended special privilege accesses to the computer resources.

• Question 118:

  What does the following command achieve?

  Telnet

  HEAD /HTTP/1.0

  A. This command returns the home page for the IP address specified
  B. This command opens a backdoor Telnet session to the IP address specified
  C. This command returns the banner of the website specified by IP address
  D. This command allows a hacker to determine the sites security
  E. This command is bogus and will accomplish nothing
  C. This command returns the banner of the website specified by IP address

  ---

  This command is used for banner grabbing. Banner grabbing helps identify the service and version of web server running.

• Question 119:

  A buffer overflow occurs when a program or process tries to store more data in a buffer (temporary data storage area) then it was intended to hold. What is the most common cause of buffer overflow in software today?

  A. Bad permissions on files.
  B. High bandwidth and large number of users.
  C. Usage of non standard programming languages.
  D. Bad quality assurance on software produced.
  D. Bad quality assurance on software produced.

  ---

  Technically, a buffer overflow is a problem with the program's internal implementation.

• Question 120:

  What ports should be blocked on the firewall to prevent NetBIOS traffic from not coming through the firewall if your network is comprised of Windows NT, 2000, and XP?(Choose all that apply.

  A. 110
  B. 135
  C. 139
  D. 161
  E. 445
  F. 1024
  B. 135
  C. 139
  E. 445

  ---

  NetBIOS traffic can quickly be used to enumerate and attack Windows computers. Ports 135, 139, and 445 should be blocked.